domains / security / cis-benchmark-audit / cis-benchmarks

cis-benchmarks

Skill card

combined

The second copy is a safety-hardened adaptation of the first, but it changes the operational procedure in ways that would hide a real alternative if one copy were crowned. The first copy provides concrete, runnable commands (hardcoded CIS profile ID, specific kube-bench check sections, fixed report paths). The second copy replaces those with variable-driven, approval-gated steps (oscap info to discover profile, reviewed image digest, private audit directory, explicit limitations and read-only inventory). Because the copies disagree on how to select the OpenSCAP profile, how to pin the kube-bench image, and where to write reports, crowning one would discard the other's material constraints.

Repositories

Other copies

Combined skill

---
name: cis-benchmarks
description: Audit and remediate CIS benchmark violations. Use automated tools to assess compliance and implement hardening recommendations. Use when meeting compliance requirements or implementing security baselines.
license: MIT
metadata:
  author: devops-skills
  version: "1.0"
---

# CIS Benchmarks

Implement and audit CIS security benchmarks. Assess a selected benchmark/version against explicitly authorized systems. Scanner output is partial evidence, not certification; verify applicability, documented exceptions and operational impact before remediation.

## When to Use This Skill

Use this skill when:
- Assessing security compliance
- Implementing security baselines
- Meeting regulatory requirements
- Hardening systems to standards

## Assessment Tools

### OpenSCAP

```bash
# Install
apt install openscap-scanner scap-security-guide

# Confirm installed content matches the actual OS and required benchmark/version.
SCAP_FILE="<approved-installed-datastream.xml>"
oscap info "$SCAP_FILE"
PROFILE_ID="<exact-CIS-profile-listed-by-oscap-info>"
# Run the selected assessment only after scope and report-location approval.
oscap xccdf eval \
  --profile "$PROFILE_ID" \
  --results results.xml \
  --report report.html \
  "$SCAP_FILE"
```

### Lynis

```bash
# Install
apt install lynis

# Run audit
lynis audit system

# Generate report
lynis audit system --report-file "$PRIVATE_AUDIT_DIR/lynis-report.dat"
```

### InSpec

```ruby
# cis-profile/controls/ssh.rb
control 'cis-ssh-1' do
  impact 1.0
  title 'Ensure SSH root login is disabled'
  
  describe sshd_config do
    its('PermitRootLogin') { should eq 'no' }
  end
end

control 'cis-ssh-2' do
  impact 0.7
  title 'Ensure SSH password authentication is disabled'
  
  describe sshd_config do
    its('PasswordAuthentication') { should eq 'no' }
  end
end
```

```bash
# Run InSpec
inspec exec cis-profile -t ssh://user@target
```

### Kubernetes CIS

```bash
# kube-bench
docker run --rm -v /etc:/etc:ro -v /var:/var:ro \
  aquasec/kube-bench@sha256:<reviewed-image-digest> run --targets node

# Check specific sections
kube-bench --help
# Select role/sections supported by the reviewed version and actual cluster; do not assume master is a current target name.
```

## Remediation Workflow

```yaml
workflow:
  1_scan:
    - Run automated assessment
    - Generate baseline report
    
  2_analyze:
    - Review findings
    - Identify false positives
    - Prioritize by risk
    
  3_remediate:
    - Apply fixes
    - Document exceptions
    - Verify changes
    
  4_validate:
    - Re-run assessment
    - Confirm remediation
    - Generate compliance report
```

## Best Practices

- Baseline before hardening
- Document exceptions
- Automate assessments
- Track compliance over time
- Regular re-assessment
- Version control configurations

## Related Skills

- linux-hardening - Linux security
- vulnerability-scanning - Security scanning

## Limitations

- An OpenSCAP/Lynis assessment may require privileges and read sensitive host configuration; approve the exact host, profile, privileges, private outputs and limits first. Do not enable auto-remediation or mount all host paths without reviewing necessity. A generic Lynis audit is not a complete CIS benchmark.
- Benchmark/profile identifiers and installed SCAP content vary; use OpenSCAP's documented info/eval flow. Test changes and preserve rollback/access before hardening production.
- Docs-only import: upstream scripts and templates not bundled.

### Example

```bash
# Read-only first: inventory before any active step.
command -v oscap
oscap --version
```